@ Onboard Sensor Data Qualification in Human-Rated 
Launch Vehicles 

Applications include sensor data qualification and equipment condition monitoring in 
commercial power plants. 
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The avionics system software for 
human-rated launch vehicles requires 
an implementation approach that is ro- 
bust to failures, especially the failure of 
sensors used to monitor vehicle condi- 
tions that might result in an abort de- 
termination. Sensor measurements pro- 
vide the basis for operational decisions 
on human-rated launch vehicles. This 
data is often used to assess the health of 
system or subsystem components, to 
identify failures, and to take corrective 
action. An incorrect conclusion and/or 
response may result if the sensor itself 
provides faulty data, or if the data pro- 
vided by the sensor has been corrupted. 
Operational decisions based on faulty 
sensor data have the potential to be cat- 
astrophic, resulting in loss of mission or 
loss of crew. To prevent these later situ- 
ations from occurring, a Modular Arch- 
itecture and Generalized Methodology 
for Sensor Data Qualification in 
Human-rated Launch Vehicles has 
been developed. 

Sensor Data Qualification (SDQ) is a 
set of algorithms that can be imple- 
mented in onboard flight software, and 
can be used to qualify data obtained 
from flight-critical sensors prior to the 
data being used by other flight software 
algorithms. Qualified data has been ana- 
lyzed by SDQ and is determined to be a 


true representation of the sensed system 
state; that is, the sensor data is deter- 
mined not to be corrupted by sensor 
faults or signal transmission faults. Sen- 
sor data can become corrupted by faults 
at any point in the signal path between 
the sensor and the flight computer. 
Qualifying the sensor data has the bene- 
fit of ensuring that erroneous data is 
identified and flagged before otherwise 
being used for operational decisions, 
thus increasing confidence in the re- 
sponse of the other flight software 
processes using the qualified data, and 
decreasing the probability of false 
alarms or missed detections. 

At a high level, SDQ is called by the 
flight computer, as required each cycle, 
to qualify a specific sensor or set of sen- 
sors. SDQ first determines the update- 
rate of the data, and obtains the speci- 
fied data from the sensor data table. 
SDQ then consults the data provided by 
the Mission Manager Function to deter- 
mine the appropriate subset of pre-de- 
fined algorithms, thresholds, and pa- 
rameters to be used in qualifying 
specified sensor data. Next, appropriate 
algorithms are applied to the data. If a 
given algorithm determines that the 
data is faulty, the associated data signal 
accrues a strike from that algorithm for 
the current flight computer cycle, and 


the algorithm or algorithms that failed 
the data are recorded. Having run all ap- 
plicable fault detection algorithms, the 
strike counters for each of the applica- 
ble algorithm/sensor pairs are then 
tested for the persistence of any failures. 
Sensors associated with data that meets 
persistence criteria are flagged as per- 
manently failed. 

Alternate embodiments of some of the 
qualification algorithms used in the Ares 
SDQ architecture have prior implemen- 
tations that were incorporated into com- 
mercial data qualification development 
and analysis tools under the SureSense 
trademark. SureSense has been used to 
develop and implement real-time data 
qualification algorithms for ground- 
based nuclear power generation systems. 

This work was done by Edmond Wong and 
Kevin J. Melcher of Glenn Research Center; 
William A. Maul, Amy K. Chicatelli, Thomas 
S. Sowers, and Christopher Fulton of QinetiQ 
North America; and Randall Bickford of Ex- 
pert Microsystems, Inc. Further information is 
contained in a TSP (see page 1 ). 

Inquiries concer ning rights for the commer- 
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® Rugged, Portable, Real-Time Optical Gaseous Analyzer for 
Hydrogen Fluoride 

Applications include trace gas sensor applications where rapid sampling is required, particularly 
in human-occupied closed volumes. 
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Hydrogen fluoride (HF) is a primary 
evolved combustion product of fluori- 
nated and perfluorinated hydrocarbons. 
HF is produced during combustion by 
the presence of impurities and hydro- 
gen-containing polymers including poly- 
imides. This effect is especially danger- 
ous in closed occupied volumes like 
spacecraft and submarines. In these sys- 


tems, combinations of perfluorinated hy- 
drocarbons and polyimides are used for 
insulating wiring. HF is both highly toxic 
and short-lived in closed environments 
due to its reactivity. The high reactivity 
also makes HF sampling problematic. 

An infrared optical sensor can detect 
promptly evolving HF with minimal sam- 
pling requirements, while providing 


both high sensitivity and high specificity. 
A rugged optical path length enhance- 
ment architecture enables both high HF 
sensitivity and rapid environmental sam- 
pling with minimal gaseous contact with 
the low-reactivity sensor surfaces. The 
inert optical sample cell, combined with 
infrared semiconductor lasers, is joined 
with an analog and digital electronic 
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